Re^2: One true regexp for untainting windows filenames?

[jaldhar]

in reply to Re: One true regexp for untainting windows filenames?
in thread One true regexp for untainting windows filenames?

Thanks for the tip. I found slightly more understandable code in File::Spec which has resulted in the following regexps: for Unix...

qr{(\A (?: .* / (?: \.\.?\z )? )? [^/]* )}msx;

...and Windows (includes UNC paths)...

qr{(\A
    (?:
        [a-zA-Z]:
        |
        (?:\\\\\\\\|//)[^\\\\/]+[\\\\/][^\\\\/]+
    )?
    (?:.*[\\/](?:\.\.?\Z(?!\n))?)?
    .*
)}msx;

[ikegami]

There is no a string that

qr{(\A (?: .* / (?: \.\.?\z )? )? [^/]* )}msx

won't match.

It's wrong for two reasons.

• "foo" gets "untainted" as "".
• "x/xx\0xx"" is believed to be a valid file name, but it isn't.

Valid unix paths and only valid unix paths match

qr{^([\0]+)\z}

(Although that doesn't mean there can ever be a file referenced by that path.)